Integrated Assessment Record Privacy, Security and Consent Management Training

1. Integrated Assessment RecordPrivacy, Security and Consent Management Training

2. Agenda • Introduction • Privacy and Security Processes • Incident Management • Consent Management • Client Privacy Rights Support • Audit Log Review • Privacy Review • User Account Management • EMPI • Communications • Awareness and Training • Next Steps and Reminders

3. Introduction

4. Purpose of Training • Provide a thorough understanding of the privacy and security key processes that support IAR as mentioned in the Data Sharing Agreement • Provide guidelines to implement these privacy and security processes in each HSP in compliance with privacy legislation • Begin planning the integration of the IAR processes into your existing HSP processes • Help you meet the IAR implementation milestones 4

5. What is the Integrated Assessment Record (IAR)? • The IAR is an application that allows assessment information to move with the client from one health service provider to another. • Health service providers (HSPs) can use the IAR to view timely client assessment information: • electronically • securely • accurately Community Care Access Centres Long-Term Care Homes CommunitySupport Services Others Inpatient Mental Health Addictions Community Mental Health 5

6. Information Flow: Today Your HSP’s privacy policy and processes Use Disclosure Fax Collection Mail Phone Courier Clients YourHSP Other HSPs Governed and supported by: 6

7. Information Flow: IAR Disclosure CCAC LTCH CMH YourHSP Governed and supported by: 7

8. Collection, Use and Disclosure of Assessments Disclosure Use Fax Collection Mail Phone Clients Courier YourHSP Other HSPs Disclosure Disclosure CCAC LTCH CMH Other CSS HSPs 8

9. What is Privacy? Privacy is the right of an individual to control the collection, use and disclosure of his/her personal information. 9

10. Health Information Custodian “Health information custodian” means a person or organization (described in PHIPA) who has custody or control of Personal Health Information as a result of or in connection with performing the person’s or organization’s powers or duties or the work. The HSP who collects/uses/discloses the assessment is the Health Information Custodian (HIC) for the assessment – in its role as a HIC, the HSP has to fulfill their obligations as prescribed in PHIPA 10

11. Health Information Network Provider PHIPA defines this legal term as “a person [or organization] who provides services to two or more health information custodians where the services are provided primarily to custodians to enable the custodians to use electronic means to disclose personal health information to one another, whether or not the person is an agent of any of the custodians.” O. Reg. 329/04, s. 6 (2). 11

12. Collection, Use and Disclosure Privacy activities are described using three terms: Collect: An HSP has ‘collected’ PHI when it has gathered, acquired, received or obtained information about a client by any means from any source. Use:An HSP ‘uses’ PHI when it handles or deals with PHI that it has collected. Disclose: An HSP discloses PHI when it makes information in its custody available to other HSPs or to other people outside of the HSP. 12

13. Ontario Health Information Privacy Legislation PHIPA – Personal Health Information Protection Act Ontario’s privacy in healthcare legislation introduced in 2004 PHIPA is informed by the 10 privacy principles set out in the Canadian Standards Association Model Code for the Protection of Personal Information The Act regulates how patients’ (or clients’) Personal Health Information is collected, used, retained, transferred, disclosed, provided access to and disposed of. The Act applies to a variety of organizations and individuals within the health care sector, including but not limited to, health information custodians (e.g., hospitals and health care practitioners), agents to HIC (who can be either organizations or individuals, and who are authorized to act for or on a health information custodian’s behalf), health information network provider (HINP). 13

14. IAR HINP and HICPrivacy Obligations 14 14 14

15. HINP Privacy and Security Obligations Designate a Health Information Network Provider (HINP) Privacy Officer Sign the Data Sharing Agreement (DSA) Coordinate consent/consent directive management Coordinate incident management Coordinate the support of client’s privacy rights Manage user accounts in IAR Review IAR logs Perform Threat and Risk Assessment (TRA) and Privacy Impact Assessment (PIA) Publish privacy practices, plain language description of IAR services, safeguards for IAR services, summary of PIA/TRA 15 15

16. HIC/HSP Privacy and Security Obligations Designate a privacy contact person (HSP Privacy Officer) Sign the Data Sharing Agreement (DSA) Manage client’s consent and consent directive Manage privacy incidents Support client’s privacy rights Manage user accounts Review logs Manage client’s demographics in Enterprise Management Patient Index (EMPI) Other HSP’s general privacy obligations (i.e., publish privacy practices, data accuracy) 16 16

17. IAR Privacy and Security Implementation Framework 17

18. Privacy and Security Key Processes IAR Privacy & Security Implementation Framework DATA SHARING AGREEMENT (DSA) ClientPrivacyRightsSupport AuditLogReview Privacy Review UserAccountManagement EnterpriseMasterPatientIndex Incident Management Consent Management Communication ● Awareness and Training Privacy and Security Support 18

19. Data Sharing Agreement Formal agreement between parties who agree to share data Define the terms and conditions governing the data sharing Establish the accountabilities and responsibilities with regards to data sharing Define the obligations and rights of each participant Describe the PHI privacy and security requirements Instil trust among participants to enable the data sharing DSA Workshop available to explain the document in detail DSA is available on the CCIM website:https://www.ccim.on.ca/IAR/Private/Pages/Security%20and%20Privacy%20ToolKit.aspx 19

20. Privacy and Security Process Implementation Steps Analyze existing internal processes with the requirements presented and determine gaps Design new process or process steps to address the gaps Develop the required processes, process steps or supporting artifacts Implement the newly designed and developed process or steps (remember to include training and communications to HSP staff) STEP1ANALYZE STEP 2DESIGN STEP 3DEVELOP STEP 4IMPLEMENT 20 20

21. Incident Management Integrated Incident Management 21

22. Incident Management What is Incident Management? The ability to provide end-to-end management of a series of events that are initiated in response to a privacy or security breach Integrated incident management process must be established to coordinate the incident response activities among all participating organizations, which includes: Detection Escalation, notification and reporting Incident handling (containment, eradication, recovery) Lessons learned The process will interface with each HSP’s incident management process and will focus on collaboration and cooperation activities 22

23. Example of Incidents Printed patient assessment information is left in public area (e.g., coffee shop) Theft, loss, damage, unauthorized destruction or modification of patient records Inappropriate access to patient information by unauthorized users Out of the ordinary user activity as indicated during a regular log review User account and password was compromised Network infrastructure is attacked by hackers Violation of joint security and privacy policies or procedures 23

24. Incident Management Assumptions Incident management processes exist at both health information custodian (HIC) and health information network provider (HINP) organizations Privacy Officer role exists at HICs and HINP Existing HIC level incident management process has identified incident contact person (e.g., Privacy Officer) Incidents can be reported through the incident contact person at the HICs 24

25. Integrated Incident Management Approach Four phases in the integrated incident management process: Detection Escalation Handling Reporting The most responsible party activates internal processes to handle the incident The party that receives incident report escalates incident to the most responsible party The most responsible party updates the Incident Registry at HINP and notifies affected clients 25 25

26. Privacy Breach Protocol Information & Privacy Commissioner (IPC) recommends that the HINP develop a privacy breach protocol The protocol enables the HINP and participating HSPs to respond quickly and in a coordinated way during a privacy breach Roles and responsibilities are defined Investigation and containment are effective and efficient Remediation is easy to implement 26

27. Incident Management Process Maps Incidents can be detected or reported from the following parties: HIC Client or third party of the HIC HINP Third parties (e.g., agents or service providers) of HINP Processes are developed based on the four parties defined above

28. Scenario 1 — Incident Detected by HIC HIC detected an incident, such as: Printed patient assessment records were lost User account and password were compromised Network at HIC was broken into by hackers (suspect IAR upload files have been accessed) 28

29. 1.0 Incident Detected by HIC *Shaded boxes indicate existing steps in HSPs

30. Scenario 2 – Incident Reported by Client / Third Party A client / third party reports an incident to a participating HSP, such as: “My ex-spouse working in your organization accessed my medical information and used it in our child custody case. Why can he / she access my medical record?” A third party (non-client) found printed assessment information on HSP letterhead left at local coffee shop 30

31. 2.0 Incident Reported by Client / Third Party of HIC *Shaded boxes indicate existing steps in HSPs.

32. Scenario 3 — Incident Detected by HINP HINP detected an incident, such as: IAR backup data unaccounted for (lost or stolen) Potential misuse of access is identified Extraordinary user activity as indicated by regular review Data backup tape that contains server and system data is missing 32

33. 3.0 Incident Detected by HINP *Shaded boxes indicate existing steps in HSPs.

34. Scenario 4 – Incident Reported by Third Party of HINP Third party may report an incident to HINP, such as: Record management service provider reports to HINP that one IAR data backup tape is missing during transit Data backup tape that contains server and system data is missing 34 34

35. 4.0 Incident Reported by Third Party of HINP *Shaded boxes indicate existing steps in HSPs.

36. Incident Management: Analyze Map and review existing (internal) incident handling and management process and supporting artifacts Incident handling process Client notification process Investigation, containment and recovery process Communication mechanism to client, staff and third parties (i.e., poster / brochure / website) 36

37. Incident Management: Design Review each integration point Detection Escalation Handling Reporting Make decision on each integration point Update the existing process 37

38. Integration Points and Questions 38

39. Incident Management: Implement Internal approval of revised/new process(es) Provide training and awareness to all staff members in your organization (not just clinicians or IAR users) External communications (clients and third parties) Poster, brochure, corporate website, centralized e-mail box 39

40. Consent Management Consent Management

41. Consent Management — Overview Enables client control over how their personal health information (PHI) is collected, used, disclosed and shared Ensures compliance with PHIPA Consent Directive A client’s instruction on how their Personal Health Information can be collected, used and disclosed Consent Model Informed consent Implied and express consent Scope of consent directive Structure of consent form (if required) Consent Management Process 41 41

42. Informed Consent — Elements of Informed Consent Clients should be informed about: What information about them is being collected, used and disclosed Why their information is being collected, use and disclosed (i.e., The purposes of the collection, use or disclosure, as the case may be (2004, c. 3, Sched. A, s. 18 (5).) How information is being collected, used and disclosed and with whom Individual’s right to give or withhold consent (2004, c. 3, Sched. A, s. 18 (5)) The positive and negative consequences of giving, withholding or withdrawing consent 42

43. Implied and Express Consent Types Implied Consent – refers to situations in which it is reasonable to infer that the client is consenting and it is not necessary to specifically (or expressly) ask for the client’s Consent. Express Consent – refers to situations where Consent is given explicitly, either orally or in writing. Express Consent can be signed or checked off on a list. The key is to ensure the consent obtained is valid. 43

44. Consent Form – Page 36 Implementation Guide 44

45. Sample Brochure 45

46. Sample Brochure 46

47. Sample Poster 47

48. Message Script The collection, use, disclosure (share) of client’s assessment We will/would like to complete the assessment with you to identify the support and service you need. The assessment will cover <<Description of Information that may be part of the assessment>>. We collect and use your personal health information during the assessment in order to provide you with services that suit your individual needs. We also use your information to coordinate service planning with other Health Service Providers in order to provide you with better service. Sharing of client’s assessment If you agree, your information may also be shared via an electronic sharing system with other agencies that provide services to you. What your Consent means Your information may only shared with other agencies with your Consent. If you do not want to share your assessment information with other agencies, you can let me know today or inform our staff anytime in the future, and we will make sure the assessment will not be shared. We also use a centralized electronic system to share assessments among partner agencies. The electronic system stores all of your assessment from <<HSP name>> and other agencies. If you don’t want any of the assessment information shared in the electronic system, please contact the support centre, who will ensure that no one will be able to access your assessments. You should know that your consent directive will take effect in <<# number of business days>>.Optional: If you give us your consent, this may mean: <<Positive and negative consequences for sharing the assessment>>. If you choose to withdraw your consent and not share your assessment, this may mean: <<Positive and negative consequences for not sharing the assessment>>. Your privacy rights You can request a copy of the assessment information in your file by contacting us. You also have the right to request a correction or amendment to your assessment information, or log a complaint if you feel that we have not addressed your privacy concern correctly. More information or question? If you would like to know more about how your personal health information is handled and shared with agencies, you can contact the privacy officer at the <<HSP name>>. They will help you understand what it means to share your assessment and will be able to answer your questions. Please contact our designated privacy contact at <<contact information>>. 48

49. Group Discussion • Discuss at your table what your current process is for informed consent. • What methods do you use? • Posters • Brochures • Face to face discussion • What methods do we want to add or change in the future? • What types of material would you develop to support the future method of informing? • What do we currently tell our clients? • What will we tell our clients about IAR? 49

50. IAR Consent Model IAR supports two levels of Consent Directive: HSP-level Consent Directive applied to the assessments collected by the individual HSP IAR-level Consent Directive applied to all assessments in IAR relating to a client